Extracted

• • Target
    f38cad23d9422f450277de962daa8a26f51a4177b93bb5f0eddeb74475643ab9
  • Size 45KB
  • SHA256 f38cad23d9422f450277de962daa8a26f51a4177b93bb5f0eddeb74475643ab9
  • MD5 1bbad7951490b9188dbcc23f9a167551
  • SHA1 c44653e9ed9fe6122931fa1cd4f43d79b23f5a5f
  • SHA512 e2e39933d3ca48610b2574a5b3b3eac5d687d898cee31b781ea83c86db722edac9bfb0e3f1b252bc2c2908599a4c40f0834b7143a7fc008e2f5309cfda1031fa
  • SSDEEP 768:ku40ZTX3uXTaWUgzW0mo2qwnZTohEaSPIGzjbhgX3inlKhDUejUxDnBDZMx:ku40ZTXEb2d4Ea7G3bOXS8hoNzdMx
  • TLSH
    T16D231A003BE8822BF2BE4F789DF26145867AF5A36603D5491CC441DB5613FC6DA42AFE
  • MD5 SHA1 SHA512 SSDEEP TLSH

  Score

  10^/10

  defaultcommand_and_controldefense_evasiondiscoveryexecutionasyncratpersistencerat

  • Async RAT payload

    rat

  • Family: AsyncRat

    AsyncRAT is designed to remotely monitor and control other computers written in C#.

    ratasyncrat

  • Checks computer location settings

    Looks up country code configured in the registry, likely geofence.

  • Executes dropped EXE

  • Outbound SSH connection to public host

    SSH is used for remote access. This may indicate SSH host discovery, encrypted C2 traffic, or data exfiltration.

    command_and_control
  behavioral1behavioral2